Analysis
- max time kernel
126s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
12/09/2024, 01:31
General
- Target 497fa678528f8dc7dfaebe76f73061581f621d5eb2ed06e0c8b937a9131e9191.exe
- Size 1.8MB
- Sample240912-bxjynsthkl
- SHA256 497fa678528f8dc7dfaebe76f73061581f621d5eb2ed06e0c8b937a9131e9191
Malware Config
Extracted
-
lokibot
-
http://idp.vn/wp-includes/js/crop/Panel/five/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Extracted
-
sality
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- AdWind
A Java-based RAT family operated as malware-as-a-service.
- Class file contains resources related to AdWind 2 IoCs
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Modifies firewall policy service 3 TTPs 6 IoCs
- Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
- Sality
Sality is backdoor written in C++, first discovered in 2003.
- UAC bypass 3 TTPs 2 IoCs
- Windows security bypass 2 TTPs 12 IoCs
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 IoCs
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 3 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 33 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Windows security modification 2 TTPs 14 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory 8 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 11 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 2 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\497fa678528f8dc7dfaebe76f73061581f621d5eb2ed06e0c8b937a9131e9191.exe"C:\Users\Admin\AppData\Local\Temp\497fa678528f8dc7dfaebe76f73061581f621d5eb2ed06e0c8b937a9131e9191.exe"2⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Windows\system32\server.jar"3⤵
-
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Windows\system32\server1.jar"3⤵
-
-
C:\Windows\SysWOW64\build.exe"C:\Windows\system32\build.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Accesses Microsoft Outlook profiles
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\buildmgr.exeC:\Windows\SysWOW64\buildmgr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 5165⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Windows\system32\server.jar"4⤵
-
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Windows\system32\server1.jar"4⤵
-
-
C:\Windows\SysWOW64\build.exe"C:\Windows\system32\build.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\buildmgr.exeC:\Windows\SysWOW64\buildmgr.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 4526⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe "4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\svchostmgr.exeC:\Users\Admin\AppData\Roaming\svchostmgr.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1780 -ip 17801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2220 -ip 22201⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
~TME436.tmp
0f5007522459c86e95ffcc62f32308f1_03d68389-5a68-4d9e-92ac-47b927e624dd
0f5007522459c86e95ffcc62f32308f1_03d68389-5a68-4d9e-92ac-47b927e624dd
svchost.exe
SYSTEM.INI
build.exe
buildmgr.exe
server.jar
server1.jar
rnaeer.pif
memory/1068-97-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-73-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-40-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-41-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-195-0x0000000000400000-0x00000000004D0000-memory.dmp
memory/1068-178-0x0000000000400000-0x00000000004D0000-memory.dmp
memory/1068-131-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-28-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-130-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-128-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-99-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-54-0x0000000004170000-0x0000000004172000-memory.dmp
memory/1068-46-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-47-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-49-0x00000000042C0000-0x00000000042C1000-memory.dmp
memory/1068-45-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-44-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-43-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-48-0x0000000004170000-0x0000000004172000-memory.dmp
memory/1068-98-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-63-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-64-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-68-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-69-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-70-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-72-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-16-0x0000000000400000-0x00000000004D0000-memory.dmp
memory/1068-38-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-78-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-79-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-80-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-82-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-84-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-88-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-87-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-92-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-94-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1068-96-0x0000000002230000-0x00000000032BE000-memory.dmp
memory/1144-110-0x0000000000400000-0x00000000004D0000-memory.dmp
memory/1144-121-0x0000000000400000-0x00000000004D0000-memory.dmp
memory/1144-119-0x0000000000400000-0x00000000004D0000-memory.dmp
memory/1780-59-0x00000000006A0000-0x00000000006A2000-memory.dmp
memory/1780-55-0x00000000006A0000-0x00000000006A2000-memory.dmp
memory/1780-62-0x0000000000400000-0x000000000042A000-memory.dmp
memory/1780-51-0x0000000000730000-0x0000000000731000-memory.dmp
memory/3268-2-0x0000000074900000-0x0000000074EB1000-memory.dmp
memory/3268-42-0x0000000074900000-0x0000000074EB1000-memory.dmp
memory/3268-1-0x0000000074900000-0x0000000074EB1000-memory.dmp
memory/3268-0-0x0000000074902000-0x0000000074903000-memory.dmp
memory/3268-7-0x0000000074900000-0x0000000074EB1000-memory.dmp
memory/3268-6-0x0000000074902000-0x0000000074903000-memory.dmp
memory/3840-56-0x0000000005B70000-0x0000000005B72000-memory.dmp
memory/3840-53-0x0000000005BC0000-0x0000000005BC1000-memory.dmp
memory/5020-103-0x0000000000400000-0x00000000004D0000-memory.dmp
memory/5020-116-0x0000000000400000-0x00000000004D0000-memory.dmp